{"id":"f61b5245-6fa3-49e1-b800-1b83b288e419","arxiv_id":"2606.25533","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":3.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey of architectures, threats, defenses, and future directions for security and privacy in RAG systems.","lead":"This survey examines security and privacy risks in Retrieval-Augmented Generation systems used with large language models across different deployment architectures. It organizes threats and defenses to support development of more trustworthy AI applications that retrieve external knowledge.","discovery_kind":"review","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"Reader correctly flagged the absence of full text and the survey nature as limiting applicability of correctness/novelty axes. With no load-bearing technical assumption to attack, the unverdicted stance remains appropriate.","tokens_in":1748,"tokens_out":228,"duration_ms":13733,"concrete_test":"Confirm that the full manuscript sections on centralized/on-device/federated/hybrid paradigms and the listed attack classes (membership inference, poisoning, etc.) are present and reference the cited prior work; if any major cited paper is omitted from the taxonomy, note the gap.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper is a survey that organizes existing literature into a unified taxonomy of threat surfaces (retrieval, context construction, generation) across RAG deployment paradigms and catalogs attack/defense classes. No original theorems, derivations, or experimental results are claimed, so there is no single falsifiable assumption whose failure would invalidate a quantitative or formal central result. The coverage claim is definitional to the survey genre rather than a testable proposition.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript is a survey on security and privacy in Retrieval-Augmented Generation (RAG) systems. It examines risks across centralized, on-device (Micro-RAG), federated, and hybrid deployment paradigms; introduces a unified taxonomy of threat surfaces spanning retrieval, context construction, and generation stages; catalogs attack classes including membership inference, index inference, poisoning, gradient leakage, and collusion; reviews architectural, algorithmic, and cryptographic defenses with attention to privacy-utility trade-offs; and identifies open research challenges for trustworthy RAG systems.","tokens_in":1776,"tokens_out":355,"duration_ms":23100,"significance":"If the coverage and taxonomy hold, the survey provides a useful organizing framework for an emerging area where RAG adoption introduces privacy and security risks beyond standard LLM threats. Systematizing attacks and defenses across multiple paradigms, along with explicit discussion of deployment considerations, can help researchers identify gaps and practitioners evaluate trade-offs. The work is a literature survey with no original theorems, experiments, or machine-checked proofs.","major_comments":[],"minor_comments":[{"comment":"Abstract: the claim of a 'unified taxonomy' would be strengthened by a brief statement of the criteria used to unify prior taxonomies or by a forward reference to the section where the unification is demonstrated.","section":null},{"comment":"The manuscript would benefit from an explicit table or figure that maps each attack class to the deployment paradigms (centralized, on-device, federated, hybrid) in which it has been studied or is applicable.","section":null},{"comment":"Section headings and subsection numbering should be checked for consistency with the taxonomy stages (retrieval, context construction, generation) to improve navigation.","section":null}],"recommendation":"minor_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the positive summary and assessment of our survey, as well as the recommendation for minor revision. No specific major comments were provided in the report, so we have no individual points to address. We remain available to incorporate any minor editorial suggestions if requested.","responses":[],"tokens_in":1207,"tokens_out":73,"duration_ms":9883,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"This is a survey that pulls together security and privacy risks in retrieval-augmented generation. It does not introduce new attacks, defenses, or experiments; the core is a taxonomy of threat surfaces across retrieval, context construction, and generation stages, plus attack classes like membership inference, poisoning, and collusion.\n\nIt does a reasonable job covering different deployment models—centralized, on-device, federated, and hybrid—and notes privacy-utility trade-offs in the defenses it reviews. That structure can help someone map the main risk areas quickly.\n\nThe main limitation is that its value depends entirely on how complete and accurate the literature coverage turns out to be. As a compilation, it risks restating known categories without adding fresh connections, and any gaps in the cited work would reduce its usefulness. The abstract presents the scope clearly, but the paper carries no formal results or data that could be checked independently.\n\nThis is for practitioners and researchers in AI security who want an overview of RAG-specific issues rather than primary research. It deserves peer review because a clear taxonomy in a fast-moving area can serve as a reference, even if the paper itself is not advancing the technical frontier.","headline":"A competent survey that organizes RAG security threats and defenses but adds no new techniques or findings.","tokens_in":2279,"tokens_out":302,"would_cite":false,"duration_ms":19469,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Retrieval-augmented generation systems introduce security and privacy risks through their retrieval mechanisms that go beyond those of standard language models.","keywords":["retrieval-augmented generation","security","privacy","adversarial attacks","federated systems","large language models","knowledge bases","defenses"],"falsifier":"Identification of a major privacy or security vulnerability in an operational RAG system whose attack surface falls outside the taxonomy categories of retrieval, context construction, and generation.","tokens_in":2626,"feed_emoji":"🔒","tokens_out":618,"duration_ms":17974,"temperature":0.7,"pith_summary":"This survey examines how coupling external retrieval with generative models creates new exposure points for sensitive data and allows manipulation of outputs. It organizes risks across centralized, on-device, federated, and hybrid RAG deployments by mapping threats that arise during retrieval, context construction, and generation. The work catalogs attack types such as membership inference, index inference, poisoning, gradient leakage, and collusion, then reviews corresponding architectural, algorithmic, and cryptographic defenses while noting their utility trade-offs. It closes by identifying open challenges for making RAG systems trustworthy in practice.","feed_headline":"RAG retrieval stages create distinct privacy and security risks","feed_subtitle":"Survey maps exposure points across centralized, on-device and federated setups and reviews defenses.","key_machinery":"A unified taxonomy of threat surfaces spanning the retrieval, context construction, and generation stages.","core_discovery":"Integrating retrieval pipelines in RAG systems exposes sensitive information through retrieval indices, query logs, context construction, or federated updates, while adversarial manipulation of knowledge bases can undermine trust in generated outputs, requiring a unified taxonomy of threat surfaces across retrieval, context construction, and generation stages together with analysis of attacks and defenses in centralized, on-device, federated, and hybrid paradigms.","pith_inferences":["Standard LLM safety layers will need explicit extensions to cover the retrieval stage if the taxonomy holds.","Empirical measurement of real-world RAG data exposure events could test whether the listed attack classes are exhaustive.","Cryptographic techniques applied at the index level might reduce leakage without full redesign of retrieval pipelines.","The taxonomy could guide standardized auditing protocols for RAG systems in regulated domains."],"forward_implications":["Defenses must address retrieval-specific surfaces such as index poisoning and query log leakage in addition to generation-stage threats.","Architectural choices for RAG deployments carry measurable privacy-utility trade-offs that vary by paradigm.","Attacks including membership inference and collusion can compromise both data confidentiality and output integrity.","Hybrid and federated RAG setups require additional protections against gradient leakage and inter-party collusion."],"fun_headline_variants":["RAG retrieval exposes privacy through indices and query logs","RAG systems face security risks in context construction and generation","Threats in RAG span retrieval to federated updates across setups","Survey details attacks like poisoning and inference on RAG pipelines","Defenses needed for privacy in centralized on-device and hybrid RAG"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The presented unified taxonomy of threat surfaces and listed attack classes adequately covers the primary risks across all RAG paradigms.","fun_headline_variants_meta":{"raw":{"variants":["RAG retrieval exposes privacy through indices and query logs","RAG systems face security risks in context construction and generation","Threats in RAG span retrieval to federated updates across setups","Survey details attacks like poisoning and inference on RAG pipelines","Defenses needed for privacy in centralized on-device and hybrid RAG"]},"model":"grok-4.3","cost_usd":0.004472,"raw_usage":{"total_tokens":2135,"prompt_tokens":639,"num_sources_used":0,"completion_tokens":82,"cost_in_usd_ticks":44715500,"prompt_tokens_details":{"text_tokens":639,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1414,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":639,"tokens_out":82,"duration_ms":9616,"temperature":1.0,"reasoning_tokens":1414,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-25T20:54:40.446400+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Identification of a major privacy or security vulnerability in an operational RAG system whose attack surface falls outside the taxonomy categories of retrieval, context construction, and generation.","supporting_citations":[],"review_version":1}